CyberRota Analysis
AI-GeneratedCyberPanel versions prior to 3.0.5 are vulnerable due to a failure to enforce two-factor authentication on API endpoints, enabling attackers with access to an administrator's password to bypass TOTP requirements. This allows unauthorized administrative operations and the creation of authenticated sessions without the necessary second factor. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.